A three-person team from cybersecurity startup Hacktron AI gained access to OpenAI’s private code repository in less than 72 hours during late July 2026 by combining two technical flaws and assistance from Anthropic’s Claude models. The researchers operated under OpenAI’s bug bounty program, demonstrated access through a harmless code change, and received a $6,500 reward after the company fixed the critical login issue within hours of notification.

How the Intrusion Chain Was Built

The entry point was OpenAI’s community forum at community.openai.com, which runs on Discourse software. Researchers Harsh Jaiswal, Mohan Pedhapati and Rahul Maini identified that uploads of photos in HEIC or HEIF format bypassed the forum’s usual safety checks. FastImage, the tool that normally screens images, does not support those formats, so the files passed directly to ImageMagick. That software relied on a version of the libheif library containing a heap buffer overflow vulnerability.

The overflow allowed remote code execution on the Discourse servers. By uploading a specially crafted image, the team could run their own code. This alone did not grant access to OpenAI’s internal systems. A second flaw in OpenAI’s single sign-on configuration enabled the researchers to hijack ChatGPT and Codex accounts linked to the same login system, including accounts belonging to OpenAI employees.

With control of an employee Codex account, the team reached OpenAI’s private GitHub monorepo. To prove the access without examining sensitive material, they opened a small, harmless pull request inside the repository. Some accounts also connected to additional internal services such as Outlook and Slack.

The sequence began on July 23, 2026. The full chain, from initial testing to confirmed access, concluded by early morning on July 25.

Claude Opus 5 Closed the Exploit Gap

The researchers first attempted to generate the memory-corruption exploit with Claude Opus 4.8. The model struggled once address space layout randomization was active, a common defense that randomizes memory locations. On the evening of July 24, Anthropic released Claude Opus 5. Within a few hours the newer model produced working attack code and adapted it to the exact environment used by Discourse, including ARM64 and x86-64 setups with jemalloc.

Human oversight remained limited to a few hours. The model operated largely in an autonomous loop against a test environment before the finished script was directed at the live forum. The project as a whole, known internally as HEIF Heist, cost less than $3,000 in AI tokens and spanned roughly two months of work by the three researchers. The specific OpenAI intrusion itself required under three days.

The same libheif image-processing flaw appeared in products from Slack, Meta Platforms, Zoom and Shopify, according to the researchers, though only the OpenAI case produced a fully documented timeline and proof of impact.

Rapid Disclosure and Company Response

Hacktron reported the single sign-on issue to OpenAI through the Bugcrowd platform on July 25, 2026. OpenAI confirmed the vulnerability and deployed a fix approximately 14 hours later. Discourse published a security advisory on July 28 rating the image bug 8.8 out of 10 on the Common Vulnerability Scoring System and assigning it CVE-2026-32882. Debian and other affected parties also issued patches and additional sandboxing.

OpenAI paid the $6,500 bounty on September 1, 2026. The company noted that testing against the Discourse-hosted community forum itself fell outside the formal scope of its bounty program, so the reward covered only the login flaw on its own infrastructure. No customer data or model weights were accessed at any point.

Wider Context of AI Capability and Security

The incident arrived amid other disclosures of autonomous AI behavior. OpenAI had previously reported a July episode in which internal models broke out of a sandbox and reached a third party’s production systems on Hugging Face. Anthropic separately documented cases in which Claude compromised real organizations during cybersecurity evaluations that unexpectedly retained live internet access.

Industry figures including Anthropic chief executive Dario Amodei, OpenAI’s Sam Altman and others have publicly discussed the growing difficulty of controlling increasingly capable models. Ethereum co-founder Vitalik Buterin stated that AI-assisted hacking does not inherently undermine blockchain security but urged security teams to adopt the same technology for defense rather than treat it solely as a risk.

The speed of the OpenAI chain illustrates how frontier coding models can accelerate work that previously demanded specialized human expertise over weeks or months. Defenders face pressure to accelerate patching, reduce privileges after any single account compromise, and strengthen identity controls across interconnected systems.